Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

using tcpdump i would like to filter the responses that comes back from a squid cache server to only the responses that came back from the cache. that means that i need to filter according to the X-CACHE header value, if it's value is HIT, i should show it, otherwise the response is not from the cache. any idea what should my tcpdump filter be ?

share|improve this question

migrated from stackoverflow.com Sep 6 '10 at 15:07

This question came from our site for professional and enthusiast programmers.

    
possible duplicate of tcpdump filter according to http header content. Please don't cross post. –  Dennis Williamson Sep 6 '10 at 17:03
add comment

3 Answers 3

Have you considered using ngrep instead of tcpdump?

share|improve this answer
    
no can do. the problem is that i am not using tcpdump, i am using my own executable that uses the pcap to monitor the traffic. in my own executable i can use the same filter as i use in tcpdump. ngrep or any other grep's wont help me. –  Oded Sep 6 '10 at 11:05
add comment

I don't believe that is possible. You could capture all traffic on the correct port / ip combination and then filter it using wireshark or similar.

You could also use ngrep (think grep for your network)

For this type of problem though i typically resort to using libpcap and ruby to write a quick script. You can then record only the packets you require or indeed only the information from the packets you require.

With ruby it's quite painless, i'm sure python or similar would also be straightforward.

share|improve this answer
    
Indeed. tcpdump is not a protocol-specific tool. For this, you have to use programs like dnscap for the DNS (I don't know for HTTP). –  bortzmeyer Sep 18 '10 at 13:21
add comment

It appears tcpdump can only match packet content for certain bytes, not arbitrarily search a packet for a string. Look at this advanced filter list for some guidance.

A workaround: If you add -s0 -A -w - (show entire packets, ASCII, write to standard output) to your tcpdump params, you can then use grep with some context to show only the packets that show where X-Cache: HIT.

share|improve this answer
    
wont help me, since i wrote my own program using pcap lib, that listen on my interfaces, and uses the same filters as tcpdump does, once i'll have the correct filter in tcpdump, i'll use it in my own program. i cant do grep inside my program or parse the packet content my self, since it badly hurts my performance, i was wondering if the tcpdump. –  Oded Sep 6 '10 at 9:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.